MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 dc900bfbc7009b914a2064be4732533dc3a2210e5e9fd69bcd2482da5f3614c2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	dc900bfbc7009b914a2064be4732533dc3a2210e5e9fd69bcd2482da5f3614c2
SHA3-384 hash:	bba0c8e39d23480a78933615c84e390de3cc0579f1c4457eb8e8f89c1847bbf57744fcb8d56d6276faffc392d188a9b2
SHA1 hash:	a01cce011ebb798aaeba044c4e2092167165b0b5
MD5 hash:	cbd1498429f313213cb7ab3a6bb821cb
humanhash:	kilo-papa-seven-autumn
File name:	picture.jpg.hta
Download:	download sample
Signature	RemcosRAT Alert Create hunting rule
File size:	14'844 bytes
First seen:	2026-09-29 07:46:38 UTC
Last seen:	Never
File type:	hta
MIME type:	text/html
ssdeep	48:3Triiv4Jriiv14wvKVjik0IXPukPLrOyriivLJPG:DriisriiyptVtriid+
TLSH	T1CD620F3BC159FFC48B2EA1483499336758E40F3F90789502F58E523B37AC65D9C2509E
Magika	txt
Reporter	abuse_ch
Tags:	hta RemcosRAT

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

87

Origin country :

DE

Vendor Threat Intelligence

ACCE Unknown

No detections

ClamAV Detected

Detection(s):

SecuriteInfo.com.Script.SNH-gen.96796847.UNOFFICIAL

Alert

Create hunting rule

SecuriteInfo.com.Script.SNH-gen.98636928.UNOFFICIAL

Alert

Create hunting rule

DocGuard Malicious

Result

Verdict:

Malicious

File Type:

HTA File - Malicious

Link:

https://app.docguard.net/dc900bfbc7009b914a2064be4732533dc3a2210e5e9fd69bcd2482da5f3614c2/results/dashboard

Payload URLs

URL

File name

http://107.175.148.124/45/sevenring.vbe

HTA File

Behaviour

BlacklistAPI detected

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

masquerade powershell

Link:

https://www.filescan.io/uploads/6abb6d026db45f4f3dd2ff4d/reports/86495969-b7ab-4475-a980-bc7c8211b7ba/overview

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/dc900bfbc7009b914a2064be4732533dc3a2210e5e9fd69bcd2482da5f3614c2

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

html

First seen:

2026-09-29T05:17:00Z UTC

Last seen:

2026-09-29T15:08:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/dc900bfbc7009b914a2064be4732533dc3a2210e5e9fd69bcd2482da5f3614c2/results?tab=lookup

Joe Sandbox Remcos

Result

Threat name:

Remcos

Alert

Create hunting rule

Detection:

malicious

Classification:

rans.troj.spyw.expl.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1979290

Signature

AI detected malicious Powershell script

Antivirus / Scanner detection for submitted sample

Bypasses PowerShell execution policy

C2 URLs / IPs found in malware configuration

Connects to many ports of the same IP (likely port scanning)

Contains functionality to bypass UAC (CMSTPLUA)

Contains functionality to register a low level keyboard hook

Contains functionality to steal Internet Explorer form passwords

Contains functionalty to change the wallpaper

Detected Remcos RAT

Encrypted powershell cmdline option found

Found malware configuration

Joe Sandbox ML detected suspicious sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

PowerShell case anomaly found

Powershell connects to network

Sigma detected: MSHTA Suspicious Execution 01

Sigma detected: Potentially Suspicious PowerShell Child Processes

Sigma detected: Remcos

Sigma detected: Script Interpreter Execution From Suspicious Folder

Sigma detected: Suspicious Encoded PowerShell Command Line

Sigma detected: Suspicious MSHTA Child Process

Sigma detected: Suspicious PowerShell Parameter Substring

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Tries to harvest and steal browser information (history, passwords, etc)

Unusual module load detection (module proxying)

Windows Scripting host queries suspicious COM object (likely to drop second stage)

WScript reads language and country specific registry keys (likely country aware script)

Wscript starts Powershell (via cmd or directly)

Yara detected Powershell decode and execute

Yara detected Remcos RAT

Yara detected UAC Bypass using CMSTP

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/dc900bfbc7009b914a2064be4732533dc3a2210e5e9fd69bcd2482da5f3614c2

Malva.RE inconclusive

Verdict:

inconclusive

YARA:

3 match(es)

Tags:

Html PowerShell

Link:

https://app.malva.re/file/cbd1498429f313213cb7ab3a6bb821cb

CERT.PL MWDB remcos

Detection:

remcos

Alert

Create hunting rule

Link:

https://mwdb.cert.pl/sample/dc900bfbc7009b914a2064be4732533dc3a2210e5e9fd69bcd2482da5f3614c2/

ReversingLabs TitaniumCloud Script-WScript.Dropper.Asthma

Threat name:

Script-WScript.Dropper.Asthma

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-09-29 07:39:02 UTC

File Type:

Text (HTML)

Extracted files:

1

AV detection:

10 of 36 (27.78%)

Threat level:

  3/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=3siax66hacnzcsrams7eomsthxb2eiiol2p5ng6nesbnuxzwctba._file

Hatching Triage remcos

Result

Malware family:

remcos

Alert

Create hunting rule

Score:

  10/10

Tags:

family:remcos botnet:remotehost collection defense_evasion discovery execution rat

Link:

https://tria.ge/reports/260929-jmmktavzgw/

Behaviour

Kills process with taskkill

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

outlook_office_path

Enumerates physical storage devices

Executes a command shell one-liner

Reads the TCP/IP host and domain name from the registry

System Location Discovery: System Language Discovery

ConfuserEx .NET packer

Executes a VBScript file via the Windows Script Host.

Suspicious use of SetThreadContext

Accesses Microsoft Outlook profiles

Enumerates connected drives

Checks computer location settings

Badlisted process makes network request

Command and Scripting Interpreter: PowerShell

Family: Remcos

Malware Config

C2 Extraction:

155.103.69.61:17509
155.103.69.61:17508

VMRay Malicious

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/dc900bfbc700/report/overview.html

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/dc900bfbc7009b914a2064be4732533dc3a2210e5e9fd69bcd2482da5f3614c2